Limited Free Will in Multiple Runs of a Bell Test 
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The assumption of free will - the ability of an experimentalist to make random choices - is central 
to proving the indeterminism of quantum resources, the primary tool in quantum cryptography. 
Relaxing the assumption in a Bell test allows violation of the usual classical threshold by correlating 
the random number generators used to select measurements with the devices that perform them. In 
this paper, we examine not only these correlations, but those across multiple runs of the experiment. 
This enables an explicit exposition of the optimal cheating strategy and how the correlations manifest 
themselves within this strategy. Similar to other recent results, we prove that there remain Bell 
violations for a sufficiently high, yet non-maximal degree of free will which cannot be simulated by 
a classical attack, regardless of how many runs of the experiment those choices are correlated over. 



Bell's theorem [T] provides an experimentally falsifiable 
prediction for certain correlations if Nature is determin- 
istic. That these inequalities are found to be violated 
[21 [3] constitutes proof of the incompatibility of classical, 
deterministic, theories with the Universe, no matter that 
our knowledge of said theories may be incomplete. A 
definitive Bell test, free of loopholes, is yet to be realised. 
Nevertheless, the overwhelming consensus is that quan- 
tum theory has been verified since the common loopholes 
of locality pj and detection [3] have been closed sepa- 
rately [3 [S], and Nature would be strange indeed if it 
conspired to utilise whichever loophole were available in 
order to mask its classicality. 

This violation of a Bell inequality as a proof technique 
has since been elevated to the central tool in proving the 
absence of an eavesdropper [7], being so powerful as to 
secure cryptographic schemes that need not be reliant on 
either the quantum theory that inspired them [8] or com- 
plete knowledge of the devices used to implement them 
[S] • This device-independent cryptography seeks security 
even when the users' devices are assumed to be controlled 
by an adversary, for tasks such as key distribution [5] or 
randomness expansion [10] . However, this also elevates 
the stringent requirements of loophole closure; an adver- 
sary will certainly conspire to use every tool available 
to mask the classicality induced by their eavesdropping. 
This includes subverting not only the detectors and any 
locality weaknesses, but also corrupting any other tools 
the cryptographers might import into their laboratory, 
such as random number generators (RNGs). 

Such corruption necessitates the study of 'free will' 
loopholes |11H15) in which the random numbers are not 
perfectly random, and an eavesdropper can use that 
knowledge to modify her strategy. The RNGs are charac- 
terised by an appropriate measure of the experimenters' 
free will in choosing their measurements, also known 
as measurement independence (MI). While there is no 
known way to experimentally determine this value, it re- 
mains important to understand, for a prescribed degree 
of MI, how much advantage can be gained by an ad- 



versary (or was gained previously), or how to exclude 
such influences. The latter question has recently been 
addressed in the form of randomness amplification pro- 
tocols |16fll8j in which a random input string with a given 
MI is processed into a new random string about which 
any adversary has less information. These studies have 
either assumed no correlations between different runs of 
the experiment [151 El] or [T6HI8] restricted the proba- 
bility distributions to be of a very specific form known 
as a Santha-Vazirani source [20], preventing the prede- 
termined exclusion of a measurement choice. Since this 
exclusion of a measurement choice is intimately involved 
with the optimal cheating strategy, other measures of 
MI could exhibit substantially different behaviour. The 
formulation of Santha-Vazirani sources also obscures the 
correlations between the RNGs and the Bell tests. 

In this paper, we assign the experimenters a fixed de- 
gree of MI in making their measurement choices, using a 
measure not constrained by the Santha-Vazirani condi- 
tion, and determine the maximum value that a classical 
strategy could possibly achieve in the Bell test, compar- 
ing that to the standard threshold of a Bell test. This has 
previously been examined with regards to attacking sin- 
gle runs of a CHSH test [13] , more general Bell tests [H] , 
and its application to randomness expansion fl9J. We 
show that an eavesdropper gains an advantage by corre- 
lating the partially random generation of measurement 
choices over many runs of the test. Our results explic- 
itly describe the optimal correlations between RNGs and 
measurement devices that an adversary might introduce. 
We compare this strategy to the optimal quantum strat- 
egy, allowing us to prove that when there is a large (yet 
imperfect) amount of MI, a sufficiently high Bell viola- 
tion will exclude the possibility of a classical correlated 
attack. We outline our methods for the bipartite Bell test 
due to Clauser, Home, Shimony and Holt (CHSH) [21j . 
although other Bell tests (and multipartite extensions) 
are equally amenable to the same analysis. 

Measures of Free Will. The CHSH test consists of two 
parties, Alice and Bob, making random choices, j, k, of 



which of two measurements to make, Aj, Bk, getting one 
of two outcomes, ±1. After recording the result of each 
measurement, they communicate in order to calculate 

(5) = (AoBo) + (AoSi) + (AiBo) - {A^B{). 

Assuming they have perfect RNGs, each measurement is 
equally likely, and the expected value of each measure- 
ment result (independent of what the other party mea- 
sured) is 0. In the cryptographic scenario, Alice and Bob 
are trying to use this to prove that they have a quantum 
resource, the ideal result being (5*) = 2-\/2, although no 
value {S) > 2 can be explained by somebody entirely 
replacing the quantum functionality of the box with a 
deterministic protocol. This changes, however, if the 
eavesdropper can manipulate the random measurement 
choices. Nevertheless, we will constrain the eavesdropper 
to strategies which, on average, cause each measurement 
choice to be equally likely, and each measurement out- 
come to be equally likely, otherwise Alice and Bob would 
soon spot that something was going on! 

We are interested in assessing the performance of an 
eavesdropper when they are allowed to pre-program both 
the measurement devices and the RNGs of the two par- 
ties. Their collective strategy is a program, known as a 
local hidden variable (LHV) model, that the eavesdrop- 
per designs; a random variable A G {A.^:} specifying how 
to select the measurement bases and the corresponding 
results. The degree of control that the eavesdropper has 
over the choice of measurement basis is contained in the 
probabilities of making a given choice, p[AjBk\\x). Nu- 
merous different ways have been proposed to assign a 
numerical value based on this P"5HTS1 [TO] . Perhaps the 
most natural class of measures are those with an opera- 
tional interpretation: the advantage that is gained by the 
eavesdropper's knowledge of the probability distribution 
as compared to that of Alice and Bob's: 

Mp = max^ \p[A,Bu\K)~p[A^Bk)Y'. 

We require that the marginal distributions represent- 
ing the measurement choices are uniform, p{AjBk) = 
J2xPi^3^k\^x)p{^x) — J, as is typically the case in a 
Bell test, although there may be advantages to the cryp- 
tographers to lifting this expectation [15]. The most 
natural choices for the p norm are p — 1, oo, which 
are amenable to analysis using linear programming [2^ . 
Here, we concentrate on the choice of p = oo, which will 
generalise to the multiple run case more readily. Setting 
p = (X) is equivalent to considering the largest probability 

P := ma.xp{AjBk\Xx). 

This measure was introduced in |19| . and also features 
prominently in the minimum entropy. P = 1 represents 
the possibility of an entirely deterministic selection with 
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TABLE I: Outcomes specified by an underlying variable \x 

no free will. Previous works have also utilised the mea- 
sure introduced by Hall [13] , which had the advantage of 
being independent of the marginal probability distribu- 
tions. However, it yields little insight as it is formulated 
in terms of probabilities p{\x\AjBk). Nevertheless, the 
techniques presented here can be applied to Hall's mea- 
sure, subject to some minor technical adjustments. 

Optimal One-Shot Attack. We focus on maximising 
the score of a CHSH game [5T] subject to a fixed MI 
P. The measurement settings are Aj,Bk with j,k € 
{0, 1} and the outcomes are deterministically specified 
by underlying variables A^^, i.e. Aj{Xx)t Bk{Xx) € {il}j 
such that the game evaluates 



S = A 



J2p{Xx) E PiA,,B,\Xx){~iy'{A,Bk)x^. 
Ax j,fee{o,i} 



(1) 

A single run of the experiment is said to give a 'correct 
answer' to the CHSH game if cither (j, k) ^ (1, 1) and the 
outcomes are equal, or {j,k) = (1, 1) and the outcomes 
are different. From a choice of 16 distinct outcome sets, 
half achieve the maximum local CHSH score, giving only 
one incorrect answer for the four possible query pairs. 
These are given by the four variables in Table |l| along 
with their conjugates that specify the negative outcomes 
(these do not affect correlations, but should be used half 
of the time to avoid suspicion of fixed outcomes). 

The adversarial strategy selects a set x G {0,1,2,3} 
of outcomes, uniquely defined by the underlying A^;, fol- 
lowed by the measurement settings Aj,Bk to be used, 
represented by y = 2j + k G {0,1,2,3} so that the condi- 
tional probabilities may be rewritten as p{y\x). We seek 
to maximise the CHSH score (fTl) 



5 = 4-2 J2 piy\^)^ 



(2) 



x+y—3 



subject to a fixed degree of MI P and Bayes' theorem 



^p{x)p{y\x) ^ p{y) Vy, 



(3) 



which reduces to J^xPivl-'') = 1 by the assertion that 
p{x) = p{y) = 1/4. The optimal strategy was derived 
using both Hall's measure [T31 [23] and P [TO] . The latter 
takes P G [1/4, 1/3] such that p{y\x) = P iix + y ^ 3 (i.e. 
correct answer) and p{y\x) = 1 — 3P otherwise, yielding 
S = 24P - 4 up to the threshold value P = 1/3 that 
achieves maximum 3 = 4. Optimality derives directly 
from the reasoning outlined below for the general case. 



Multiple Runs. Under the usual assumption of per- 
fect free will, the best classical eavesdropping strategy 
acts independently on each run of the experiment. A 
limited-free-will scenario necessitates re-investigation of 
the possible types of attack, since Eve may use her ex- 
tra knowledge of the underlying system's imperfections 
to correlate her strategy appropriately. This is similar to 
LHV models which exploit imperfect photon detection 
rates by simulating a detection failure and changing the 
output strategy accordingly [M] . 

Assume, as before, that Eve has written a program 
that tells Alice's and Bob's devices what to do (using 
the local measurement settings as inputs), now encod- 
ing instructions for blocks of N runs together. If Eve 
seeks to optimise the CHSH score, the outcomes for each 
run must still be drawn from Table |lj The A^-run system 
is fully characterised by the strings x,y G {0,1,2,3}^ 
such that Xn and y„ denote respectively the outcome as- 
signments and pair of measurement settings for the nth 
run. The one-shot attack distinguishes which (a;„,2/„)- 
pairs give a correct answer; the extension to N runs 
asks how many answers for a pair (x, y) are correct, 
k{x, y) := X)n=i ^xr^+vr^^i- The CHSH score is then 

S = -4 + 8^p(a;)S'a; S^ := —^p{y\x)k{x,y). 



Observe the symmetry in the structure of Sx', for each x, 
Sx is unchanged by any permutation of the p{y\x) which 
only maps a value y to y' with k{x,y) = k{x,y'). The 
set of conditional probabilities therefore reduces to the 
A^ + 1 probabilities pk, depending only on the number 
k of correct CHSH answers given. Whilst pk could vary 
depending on x, the optimal values for S are achieved by 
independent optimisation of each of the Sx , all of which 
must be equal. Hence, the aim is to maximise 
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(4) 



subject to the normalisation condition 



N 



E^^3* 



fc=0 



(5) 



whilst fixed MI P requires that pk < P^ for all k, where 
the A'th power is taken to make comparison between dif- 
ferent values of A^. This problem can be solved by linear 
programming, which confirms the following argument. 

Intuitively for a CHSH test, obtaining the maximum 
S value requires more weight to be given to the pairs of 
measurement settings that answer a larger proportion of 
the N queries correctly. Therefore we assign pjy = P^ . 
If the normalisation (Is]) allows, set pn-i = P^ , and so 
on. All remaining pk are set to 0. The curve of maximum 
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FIG. 1: The maximal CHSH expectation value S for given 
MI parameter P with varying numbers of runs N across 
which measurement basis choices are correlated. Strategies 
are classical (solid lines) or quantum (dashed lines). The 
black lines are upper bounds to correlated strategies for all 
N. The shaded region indicates achievable CHSH violations 
using quantum technology and perfect free will. 

S against P^ is piecewise linear, connected by the A^ + 1 
points defined by a parameter Z' such that 



P = 



S 



(£'(■:» 



-l/N 



N 



«^"^fc3^^^ 



A^ 



k=l' 



(6) 
(7) 



The curve is linearly interpolated for P^ , where P E 
[1/4, 1/3], between these points by assigning Pk = for 
k < I' - 1, Pk ^ P^ ioT k > I' , and letting pp_i ful- 
fil the normalisation (Is]) . Figure fl] shows such plots for 
various finite values of A. We see immediately that the 
eavesdropper gains an advantage with increasing A^, out- 
performing the single-shot attack. For certain sequences 
of measurement choices in the optimal strategy, such as 
those that have already given N — I' wrong answers, 
the impossibility of certain measurement choices is per- 
fectly predictable. Nevertheless, knowledge of the hidden 
variable A^; makes knowledge of previous measurement 
choices irrelevant to the cheating strategy. 

The optimal strategy's behaviour in the large A^ limit 
is less clear. Is the limiting curve simply the 3 = 4 
line, making perfect free will the singular point at which 
the CHSH test functions? It is enough to consider the 
A + 1 points defined by ^ and (ItI) and find lower/upper 
bounds for P/S respectively as functions of the rescaled 
parameter I = I' /N e [3/4, 1]. To bound P, observe that 
P — i Pr(A > l')^^/^ where A is a binomial distribu- 
tion with N trials and success probability p. The additive 
form of the Chernoff bound easily recovers 



P> {l/Z)\l-lf- 



(8) 



We aim to bound S by dividing the region k = V . . . N 



into two runs, split at aN, such that 

k J - yiN 



^^ - E3^-f^)>3-f,'f,)>3-e--«, 



k=l' 

N 



R2 := E3 



iAf 



k 



< ^N^-ND(a\\l) 



where we have used StirHng's approximation and a Cher- 
noff bound respectively. H(l) is the binary entropy 
while D{a\\j3) is the Kulback-Leibler divergence between 
Bernoulli distributed random variables with parameters 
a and /3. For any a = I + e with finite (but small) e, 

is exponentially small in eN. For increasing ^, 

i?l + i?2 
is increasing. In the large N limit this yields 



S'<8(; + e)-4. 



(9) 



The bound is tight given 5 > 8^ — 4. 

The regime of allowable correlated LHV attacks de- 
scribed by (|8| and ^ is depicted in Figure [T] In the 
shaded region, the S values are below 2-\/2 and therefore 
achievable with quantum technologies, and yet can never 
be simulated by any arbitrarily correlated attack. 

Quantum adversary. Tsirelson's bound proves that a 
test of the CHSH inequality with perfect free will has a 
maximum possible value of 2v2, for instance when the 
experimenters perform quantum measurements on a sin- 
glet state [25]. Such quantum strategies are known to 
be vulnerable to a limited-free-will attack in the single 
shot case by optimising over both the measurement in- 
put distribution and the measurement operators them- 
selves [in] . Further correlating over N runs of the exper- 
iment can also enhance this quantum strategy. Here we 
make the common assumption that each run is causally 
disconnected [IHl HZ], so that measurement settings or 
outcomes from earlier runs will not inform her choice of 
those in later runs. For a specified value of P, determin- 
ing the optimal quantum strategy (which will typically 
correspond to no eavesdropping) will yield the maximum 
realisable CHSH value, which is important in bounding 
an eavesdropper's knowledge for a given CHSH value. 

Using the notation py for the probabilities of a given 
set of N measurement settings described by a string y e 
{0, 1, 2, 3}^, the aim is to maximise the expectation 

4 ^ 

i=l 



where p^ = 12yyi=mPy ^^^ ^^^ marginal probabilities 
for a given setting m being chosen on run i, and the 
measurement operators Aj and Bk are two-valued oper- 
ators. Bounds on S subject to fixed P have been derived 
for an individual run in |l9j. Using the same symmetry 
arguments as above, we reduce the set {py} to {pk} ac- 
cording to the number of correct answers each set y gives. 
This leaves Pq = p\ — p^ = R and pi = 1 — 3R where, 
through the symmetry-based reduction, R is simply 



R 



fc=i 



Pk 



which is equivalent to Q up to constant factors. There- 
fore, for a fixed degree of MI requiring pk < P^ V/c, R 
is optimised by the same input distribution (see Eq. ([6])). 
The achievable values of S are then 



1(^)1 < 



3/2 



4(1 - 2R) 
VI -3i? 



provided R < 3/10 [19 . This maximal value Sq can be 
compared with the value Sc = 4(6-R— 1) obtained by the 
optimal classical, deterministic strategy as 



So^ 



2(8-5c)3/2 
3v/6(4 - Sc) 



(10) 



when Sc < 16/5. For R > 3/10, hence Sc > 16/5, 
the two strategies coincide. The quantum strategies are 
compared with their classical equivalents in Figure [1] 

Conclusions. By manipulating the RNGs used to select 
measurements in a Bell test in tandem with the devices 
performing them, an adversary may simulate a Bell vio- 
lation. The degree of violation can be bounded above in 
terms of an appropriate measure of MI. Crucially, whilst 
the adversary gains a significant advantage in employing 
attacks correlated over many runs of an experiment, as 
opposed to single-shot attacks, there are still violations 
which cannot be reproduced by such attacks if the ex- 
perimenters' degree of MI is sufficiently high. In light of 
this, existing analyses of the working regimes for device- 
independent randomness expansion |19j and key distri- 
bution protocols could be revised, although the problem 
of performing privacy amplification without trusted ran- 
domness would need addressing. Since many of these 
utilise the CHSH test, our focus on this test is imme- 
diately applicable, while application to other tests is a 
simple linear programming problem. How to experimen- 
tally assess the value of P (or another measure) in a pair 
of RNGs remains an open question. 

While our analysis does not require the RNGs to be 
Santha-Vazirani sources [20.' , as in proposed randomness 
amplification protocols [16H18] . our results can be inter- 
preted in the context of randomness amplification. Given 
sufficient information on the random source, perfect am- 
plification is possible wherever the quantum and classical 



regimes do not coincide (i.e. Sc < 16/5). Even with no 
knowledge of the random source, imperfect randomness 
can be created provided Sc < 2-\/2, with the degree of 
imperfection conveyed by the position of the 2a/2 Umit 
within the range {Sc, Sq) at a fixed P. 

JEP is supported by an EPSRC postgraduate stu- 
dentship. 
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